Suspicious sender exhibiting automated sending patterns

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	30 Minutes
Deduplication Period	1 Day
Required Data	Microsoft 365 Emails
Detection Modules	Email
Detector Tags	Phishing
ATT&CK Tactic	Initial Access (TA0001)
ATT&CK Technique	Phishing (T1566)
Severity	Informational

Description

Multiple messages from a single sender were observed over a short period, all having the same subject and differing body content. This repetitive pattern may indicate automated or scripted behavior.

Attacker's Goals

Trick the user into clicking a link, while avoiding detection.

Investigative actions

• Examine the sender's IP address and reputation.
• Verify whether the sender's IP address has appeared in different log sources before, and if it is recognizable.
• If the message contains attachments or links, scrutinize them for any suspicious indications.
• Monitor further actions taken, such as file downloads or access to potentially malicious links.

Variations

Suspicious sender with high-volume automated sending patterns

Synopsis

Field	Value
ATT&CK Tactic	Initial Access (TA0001)
ATT&CK Technique	Phishing (T1566)
Severity	Informational

Description

A high volume of messages was observed from a single sender address within a short time period, all sharing the same subject line but containing different body content. This elevated and repetitive pattern may indicate automated or scripted behavior at scale.

Attacker's Goals

Trick the user into clicking a link, while avoiding detection.

Investigative actions

• Examine the sender's IP address and reputation.
• Verify whether the sender's IP address has appeared in different log sources before, and if it is recognizable.
• If the message contains attachments or links, scrutinize them for any suspicious indications.
• Monitor further actions taken, such as file downloads or access to potentially malicious links.